omgup10[.]at

Analysis of omgup10.at, flagged on July 24, 2026 as a high‑risk generic phishing domain, shows a limited but concrete infrastructure footprint. The domain resolves to IP address 104.21.31.120, which belongs to AS13335 operated by Cloudflare, Inc., with the hosting location listed as the United States. DNS resolution uses Cloudflare authoritative nameservers aria.ns.cloudflare.com and felipe.ns.cloudflare.com, indicating that the attacker is leveraging Cloudflare’s edge services to mask the true origin of the web server. The TLS certificate presented is issued by Google Trust Services under the "WE1" label, confirming a valid, publicly trusted certificate chain. HTTP traffic is served over HTTP/3, a modern protocol also provided by Cloudflare, reinforcing the use of a high‑performance content delivery network.

The visible page title returned by the server is "omgup10.at | 502: Bad gateway," suggesting that the origin server is currently unavailable or misconfigured, while the underlying HTTP status code observed in prior scans is 200. This discrepancy indicates that the site may be intermittently active, a pattern common in phishing infrastructure that cycles between operational and dormant states to evade detection. VirusTotal reports a single detection out of ninety‑five security vendors, confirming that at least one reputable scanner has identified malicious intent associated with the domain. Additional defensive intelligence shows the domain is blocked by PhishDestroy and appears on one external security blocklist, providing corroborating evidence of its malicious classification.

Given the observed infrastructure and the presence of a single vendor detection, defenders should treat omgup10.at as a confirmed phishing vector despite the current 502 response.